Reference guide · performance · Published 2026-08-15 · 3 min read
Using a CDN for static assets
Understand CDN delivery of static assets: edge cache and hits, origin shield, purge, and dynamic pass-through, with policy examples.
- ·What a CDN does
- ·Cache hits
- ·Purge and hybrid
What a CDN does
A CDN (content delivery network) is a network of edge servers placed close to users. When you serve a site through a CDN, the edge answers requests on behalf of the origin. For static assets, images, CSS, JavaScript, fonts, the edge can cache the file and answer repeat requests from the local copy. The result: a visitor in Sydney does not wait for a connection to a European origin for the hero image; the edge in Sydney answers it. CDNs also terminate TLS, filter traffic, and can absorb sudden burst loads that would otherwise reach your server.
| Without CDN edge | With CDN edge |
|---|---|
| Every asset hits the origin | First request touches origin, then edge serves |
| Slow round trips for distant users | Nearest edge answers |
| No capacity for spikes | Edges absorb bursts |
Cache hits, misses, and ratios
A cache hit is an edge request answered from the edge copy; a miss forwards to the origin, stores the copy, and answers. The hit ratio is the proportion of hits. A well-configured static-asset CDN runs hit ratios in the high nineties.
What drives the difference between a hit and a miss is the response's cache policy. The HTTP caching guide is the detail; the short version is that a static asset should be immutable:
Cache-Control: public, max-age=31536000, immutableWith a hashed URL (a file name that includes its content hash), that policy is safe for a year, because a changed asset gets a new URL. Edge and server report hit ratios and the top missed URLs; a hot miss is usually a response with Vary: Cookie, a query-heavy URL, or a file served with a too-short max-age.
Origin shield
An origin shield is a second cache layer between the CDN's ordinary edges and the origin. Every uncached edge miss that would hit the origin instead hits the shield, which stores the response once, and the shield is the only one that requests it from the origin. With a hundred edges on the same hot request, the origin sees one download instead of a hundred. The artifact an origin shield protects: the origin server, the PHP runtime behind it, and your bandwidth bill.
Enable origin shield when: traffic is concentrated on a few hot assets, the origin backs every edge request, or a worker or cache policy runs for each entry.
Purge and the same-URL concern
When a URL genuinely changes without a new hash, a purge clears the edge copy so the next request refetches from the origin. Purges are near-instant but not immediate, and they span the regions the CDN has edges in, which can take seconds to propagate across all of them. Most CDN consoles offer a single-URL or by-prefix purge, and an API for automation. After a purge, verify rather than assume: request the URL from an edge region and confirm the new version arrives.
Dynamic pass-through
Not everything belongs in the edge cache. Logged-in pages, checkouts, and admin responses should never be cached. The two ways a CDN handles this: the response header Cache-Control: no-store stops the edge from storing it, and a cookie or path rule can exclude dynamic routes from the cache. The HTTP caching guide shows the full header policy; the same policy at the edge is the simplest and most effective performance layer for static assets and static-heavy sites. The WordPress route adds a page-cache layer for the part that cannot be cached.